Apache CouchDB versions 3.5.2 and earlier contain a vulnerability due to missing authorization checks in the chttpd component. This flaw allows any request to read the full contents of prefixed _users or _replicator databases via an unauthorized API endpoint. The use of such prefixed system databases is uncommon. The issue is fixed in version 3.5.3, and users are advised to upgrade.